search

gyselroth / balloon

High performance, feature rich document management system written for the cloud
GNU General Public License v3.0
18 stars 7 forks source link

storage blob is gone with duplicate chunkgroup in api v1 #426

Closed raffis closed 4 years ago

raffis commented 4 years ago

Describe the bug

The apiv1 writes a chunkgroup to the gridfs storage metadata. If a user chooses a duplicate chunkgroup the upload stream may get appended to finished blob. This results into wrong links and the blob of the original file gets removed if the later files gets removed and a client may get the exception:

{"error":"Balloon\\Filesystem\\Exception\\NotFound","message":"storage blob is gone","code":57}

To Reproduce

  1. curl -u admin:admin 'localhost:8084/api/v1/file/chunk?chunkgroup=NaN&chunks=1&index=1&name=test1.jpg' -XPUT -v --data-binary @/home/raffael/Pictures/Selection_029.jpg -H "Content-Type: octet/stream"
  2. curl -u admin:admin 'localhost:8084/api/v1/file/chunk?chunkgroup=NaN&chunks=1&index=1&name=test2.jpg' -XPUT -v --data-binary @/home/raffael/Pictures/Selection_029.jpg -H "Content-Type: octet/stream"
  3. Remove node completely created in 2.
  4. Fetch content from node created in 1. will result in storage blob is gone

Expected behavior

Only select chunkgroup if metadata.temporary is true.

Environment

Additional context

Note this is not a security issue since the server handles chunkgroups on a per users basis and the user is only able to destroy files which are owned by himself.

This bug does not occur in the beta releases of v2.7.x since 2.7 has an upload session management #382.